bug#41239: GTK builds crashing in XTread_socket after deleting a frame

[martin rudalics]

>> Do you mean the already existing one in delete_frame or adding a new
>> one?
>
> The existing ones cover only small parts of delete_frame, and the
> safe_call2 call is outside both of them, AFAICT.  So yes, I mean
> blocking input around the safe_call2 call.

Wouldn't that also block any 'yes-or-no-p' questions we ask when running
these hooks.  Anyway, it doesn't help.  It crashes as soon as we unblock
input, for example, thusly

--------------------------

Thread 1 "emacs" received signal SIGSEGV, Segmentation fault.
tcache_get (tc_idx=0) at malloc.c:2951
2951    malloc.c: Datei oder Verzeichnis nicht gefunden.
(gdb) bt
#0  0x00007ffff549a7be in tcache_get (tc_idx=0) at malloc.c:2951
#1  0x00007ffff549a7be in __GI___libc_malloc (bytes=16) at malloc.c:3058
#2  0x00007ffff66533ff in  () at /lib/x86_64-linux-gnu/libxcb.so.1
#3  0x00007ffff6650fb5 in  () at /lib/x86_64-linux-gnu/libxcb.so.1
#4  0x00007ffff66513b1 in  () at /lib/x86_64-linux-gnu/libxcb.so.1
#5  0x00007ffff665143d in xcb_writev () at /lib/x86_64-linux-gnu/libxcb.so.1
#6  0x00007ffff66b697e in _XSend () at /lib/x86_64-linux-gnu/libX11.so.6
#7  0x00007ffff66b6a89 in _XEventsQueued () at /lib/x86_64-linux-gnu/libX11.so.6
#8  0x00007ffff66a87b7 in XPending () at /lib/x86_64-linux-gnu/libX11.so.6
#9  0x00007ffff6f5220d in  () at /lib/x86_64-linux-gnu/libgdk-3.so.0
#10 0x00007ffff6a2b669 in g_main_context_prepare () at 
/lib/x86_64-linux-gnu/libglib-2.0.so.0
#11 0x00007ffff6a2c06b in  () at /lib/x86_64-linux-gnu/libglib-2.0.so.0
#12 0x00007ffff6a2c207 in g_main_context_pending () at 
/lib/x86_64-linux-gnu/libglib-2.0.so.0
#13 0x00007ffff7220b9d in gtk_events_pending () at 
/lib/x86_64-linux-gnu/libgtk-3.so.0
#14 0x00000000005cf188 in XTread_socket (terminal=0x1093280, 
hold_quit=0x7fffffffcab0) at ../../src/xterm.c:9377
#15 0x000000000065a86d in gobble_input () at ../../src/keyboard.c:6891
#16 0x000000000065ad4d in handle_async_input () at ../../src/keyboard.c:7128
#17 0x000000000065ad6c in process_pending_signals () at 
../../src/keyboard.c:7142
#18 0x000000000065adac in unblock_input_to (level=0) at 
../../src/keyboard.c:7157
#19 0x000000000065add0 in unblock_input () at ../../src/keyboard.c:7176
#20 0x000000000043c478 in delete_frame (frame=XIL(0x1498445), force=XIL(0x30)) 
at ../../src/frame.c:2146
#21 0x000000000043cdff in Fdelete_frame (frame=XIL(0x1498445), force=XIL(0x30)) 
at ../../src/frame.c:2333
#22 0x00000000007b3c79 in funcall_subr (subr=0xf86040 <Sdelete_frame>, 
numargs=2, args=0x7fffffffcdf0) at ../../src/eval.c:2869
#23 0x00000000007b3722 in Ffuncall (nargs=3, args=0x7fffffffcde8) at 
../../src/eval.c:2794
#24 0x0000000000836d18 in exec_byte_code (bytestr=XIL(0x7ffff3dd8ff4), 
vector=XIL(0x7ffff3c510bd), maxdepth=make_fixnum(7), 
args_template=make_fixnum(257), nargs=1, args=0x7fffffffd3f8) at 
../../src/bytecode.c:633
#25 0x00000000007b43a6 in funcall_lambda (fun=XIL(0x7ffff3c51085), nargs=1, 
arg_vector=0x7fffffffd3f0) at ../../src/eval.c:2989
#26 0x00000000007b3766 in Ffuncall (nargs=2, args=0x7fffffffd3e8) at 
../../src/eval.c:2796
#27 0x00000000007a235a in Ffuncall_interactively (nargs=2, args=0x7fffffffd3e8) 
at ../../src/callint.c:254
#28 0x00000000007b3b4c in funcall_subr (subr=0xf934c0 <Sfuncall_interactively>, 
numargs=2, args=0x7fffffffd3e8) at ../../src/eval.c:2847
#29 0x00000000007b3722 in Ffuncall (nargs=3, args=0x7fffffffd3e0) at 
../../src/eval.c:2794
#30 0x00000000007a4b24 in Fcall_interactively (function=XIL(0x7ffff2c49b90), 
record_flag=XIL(0), keys=XIL(0x2191f35)) at ../../src/callint.c:783
#31 0x00000000007b3ca5 in funcall_subr (subr=0xf93500 <Scall_interactively>, 
numargs=3, args=0x7fffffffd7c0) at ../../src/eval.c:2872
#32 0x00000000007b3722 in Ffuncall (nargs=4, args=0x7fffffffd7b8) at 
../../src/eval.c:2794
#33 0x0000000000836d18 in exec_byte_code (bytestr=XIL(0x7ffff3d8182c), 
vector=XIL(0x7ffff3d81585), maxdepth=make_fixnum(13), 
args_template=make_fixnum(1025), nargs=4, args=0x7fffffffdd38) at 
../../src/bytecode.c:633
#34 0x00000000007b43a6 in funcall_lambda (fun=XIL(0x7ffff3d81555), nargs=4, 
arg_vector=0x7fffffffdd18) at ../../src/eval.c:2989
#35 0x00000000007b3766 in Ffuncall (nargs=5, args=0x7fffffffdd10) at 
../../src/eval.c:2796
#36 0x00000000007b3133 in call4 (fn=XIL(0x41a0), arg1=XIL(0x7ffff2c49b90), 
arg2=XIL(0), arg3=XIL(0x2191f35), arg4=XIL(0x30)) at ../../src/eval.c:2676
#37 0x00000000006502dd in read_char (commandflag=1, map=XIL(0x1e7aeb3), 
prev_event=XIL(0), used_mouse_menu=0x7fffffffe13f, end_time=0x0) at 
../../src/keyboard.c:2882
#38 0x0000000000661c76 in read_key_sequence (keybuf=0x7fffffffe2d0, 
prompt=XIL(0), dont_downcase_last=false, can_return_switch_frame=true, 
fix_current_buffer=true, prevent_redisplay=false) at ../../src/keyboard.c:9553
#39 0x000000000064b214 in command_loop_1 () at ../../src/keyboard.c:1350
#40 0x00000000007af706 in internal_condition_case (bfun=0x64ad98 <command_loop_1>, 
handlers=XIL(0x90), hfun=0x64a3a7 <cmd_error>) at ../../src/eval.c:1355
#41 0x000000000064a97d in command_loop_2 (ignore=XIL(0)) at 
../../src/keyboard.c:1091
#42 0x00000000007aebba in internal_catch (tag=XIL(0xd110), func=0x64a950 
<command_loop_2>, arg=XIL(0)) at ../../src/eval.c:1116
#43 0x000000000064a91b in command_loop () at ../../src/keyboard.c:1070
#44 0x0000000000649e8e in recursive_edit_1 () at ../../src/keyboard.c:714
#45 0x000000000064a086 in Frecursive_edit () at ../../src/keyboard.c:786
#46 0x000000000064048f in main (argc=2, argv=0x7fffffffe7c8) at 
../../src/emacs.c:2054

Lisp Backtrace:
"delete-frame" (0xffffcdf0)
"handle-delete-frame" (0xffffd3f0)
"funcall-interactively" (0xffffd3e8)
"call-interactively" (0xffffd7c0)
"command-execute" (0xffffdd18)

------------------------------

Incidentally, a pure-GTK build does not crash but leaves behind all
tooltips that were open when their frame was deleted until the emacs
session is closed.  So it seems that we have to take care of these
tooltips ourselves.

The attached patch avoids the crash (and by side effect removes all
tooltips when a frame gets deleted).  The GTK warnings still appear.

martin

tooltip-crash.diff
Description: Text Data